CVE Vulnerability Catalog

The User Registration plugin (ThemeGrill) through version 5.3.0 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.

The Multiple Pages Generator plugin (Themeisle) before version 4.2.5 contains a stored XSS vulnerability that allows Contributor-level users to inject script via the base-url attribute of the [mpg] and [mpg_match] shortcodes. Malicious payloads pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}.

lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.

llama.cpp versions from b2877 before b11935 contain an uncaught exception vulnerability in the ggml-rpc server. An unauthenticated remote attacker can send an oversized message length (e.g., in a SET_TENSOR command), triggering std::length_error and aborting the process. This causes denial of service to all clients.

The flat library through version 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Keys such as a.4294967294 can block the Node.js event loop during iteration with forEach, spread, or JSON.stringify.

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows invoking arbitrary pandas functions via model-controlled function names passed to getattr(). Attackers can use prompt injection to call pandas.read_pickle on attacker-controlled paths for code execution or read local files.

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Knowing the victim's address, an attacker can become a co-owner and read messages and verification codes, set forwarding, and delete mail.

JeeSite versions 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. An attacker knowing a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.

The JetSmartFilters plugin for WordPress (Crocoblock) through version 3.8.6.2 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the site can execute in other users' browsers.

The SureForms plugin (Brainstorm Force) through version 2.12.9 does not properly neutralize script-related HTML tags, allowing Basic XSS and code injection. The issue affects versions from n/a through 2.12.9.

The InstaWP Connect plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that can force a logged-in user to perform unwanted actions. The issue affects versions from the initial release through 0.1.4.2.

A reflected cross-site scripting vulnerability exists in the agent query feature of BMC Helix Operations Management 25.4.00. An authenticated attacker can execute script in another user's browser after that user opens a crafted link.

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

Python-Markdown versions 3.0 through 3.11.2 contain an algorithmic complexity vulnerability in inline link parsing that allows remote CPU exhaustion via unmatched brackets. A short Markdown payload with repeated [ or ![ characters forces quadratic scans in LinkInlineProcessor.getText() and getLink(), keeping workers busy for minutes.